Safeguarding Privacy Or Enabling State Surveillance - Unpacking The Digital Personal Data Protection Act, 2023
Author: LawSphereX
Category: Constitutional & Human Rights
Published:
Updated:
SAFEGUARDING PRIVACY OR ENABLING STATE
SURVEILLANCE? UNPACKING THE DIGITAL PERSONAL DATA PROTECTION ACT, 2023 Aman Singh, Research Scholar, Banaras Hindu University (BHU), Varanasi, India Anjani Agarwal, Research Associate, Hon’ble High Court of Jharkhand, Ranchi, India
ABSTRACT
Fears about protecting personal data have become crucial in an era characterized by a data boom, growing digitization, and quick technical breakthroughs. It is now crucial for both governments and businesses to create more transparent data privacy standards due to the increase in digital monitoring, data breaches, and privacy violations. In order to protect people’s personal information in India, the Digital Personal Data Protection Act, 2023 was created. Its goal is to control the gathering, storing, and processing of data. Nonetheless, the Act of 2023 has number of provisions that provide the government access to personal information under certain circumstances, particularly when it comes to maintaining public order, national security, and crime prevention.
These exclusions have sparked grave worries about the possibility of privacy erosion and the establishment of a surveillance state, despite being justified legally and morally as a means of preserving security and safeguarding citizens. Those provisions are examined in this article, which looks at the risk that it presents in permitting governmental monitoring while noting the act’s capacity to preserve individual privacy. The provisions of the Act are analysed from two different points of view: one that believes they empower users by giving them greater control over their personal data, and another that fears they may unintentionally allow for data exploitation and espionage.
Keywords: Data, Surveillance, Privacy, Safeguard, State The Digital Personal Data Protection Act, 2023: A Brief Overview The new Digital Personal Data Protection Act, 2023 has drastically changed India’s stance on data privacy and protection. Many of the flaws have been fixed with the enactment of this Act, bringing India closer to the worldwide standards set by frameworks like the General Data Protection Regulation, 2016 of Europe. The right to privacy was acknowledged as a basic right under the Indian Constitution in the historic 2017 case of Justice K. S. Puttaswamy v. Union of India1. By emphasizing the need for a robust and comprehensive data protection framework in India, this verdict cleared the path for future legislation.
“India’s Digital Personal Data Protection Act, 2023 (DPDPA), a comprehensive privacy and data protection law, recognizes the right of individuals, referred to as data principals, to protect their personal data while it is being handled for lawful reasons”2. The legislation is the result of a seven-year process that started when the Indian Supreme Court ruled in the seminal case of Justice K. S. Puttaswamy v. Union of India3 and Ors that the right to privacy is a component of the fundamental right to life in India, and that this right includes the right to informational privacy. Pivacy Bodily Privacy Privacy of Information Mind Privacy DPDP Act, The facets of privacy recognized by the Hon’ble Supreme Court in landmark judgement given Justice K. S. Puttaswamy v. Union of India case. The DPDP Act of 2023 has not yet gone into force, even though it was authorized.
In response to growing concerns about identity theft, data breaches, and the unchecked power of large tech companies, the DPDP Act, 2023 provides a legislative framework to ensure that personal data is collected, processed, and stored in an open, safe, and responsible manner. Its objectives are very clear: to empower people, guarantee more openness, and force companies to handle
1 Justice K. S. Puttaswamy v. Union of India, AIR 2017 SC 4161.
2 George Lawton, “Digital Personal Data Protection Act, 2023”, TECHTARGET (Dec. 06, 2024, 9:20PM)
https://www.techtarget.com/searchdatabackup/definition/Digital-Personal-Data-Protection-Act-2023
3 Justice K. S. Puttaswamy v. Union of India, AIR 2017 SC 4161.
personal data with more accountability. The Act aims to provide a strong framework for data protection while promoting innovation in the digital economy, with an emphasis on individual permission, data security, openness, and accountability. Some of the core objectives of the DPDP Act, 2023 include: • Consent-Based Data Processing: The Act mandates that the subject give clear and informed permission before any personal data is collected, processed, or shared. • Rights of Data Subjects: Individuals now have more rights as the Digital Personal Data Protection Act of 2023 allows users to see, change, delete, or restrict the way their personal data is handled. It grants individuals certain rights, including the opportunity to view, amend, delete, and restrict the processing of their personal data.
• Data Protection Board of India4: “The Data Protection Board of India is established under the Act as an independent entity to handle complaints, oversee the implementation of data protection laws, and ensure compliance with the law”5. • Data Localization and Government Oversight: According to the Act, vital personal information must be handled and kept in India. Under some circumstances and with government authority, non-critical data can be transmitted overseas. • Transparency and Accountability: Enhanced transparency as businesses and organizations must make their privacy policies more understandable and easily available, educating consumers about data collection, storage, and sharing with third parties. Improving accountability for government and business organizations that manage personal data.
Companies are held responsible for any data breaches or misuses and are required to be transparent about their data practices. This covers risk evaluations and explicit privacy rules. • Penalties for Non-Compliance: The Act lays out consequences for noncompliance, such as fines for improper management or unlawful processing of personal information.
4 The Digital Personal Data Protection Act, 2023, § 18, No. 22, Acts of Parliament, 2023 (India).
5 The Digital Personal Data Protection Act, 2023, § 27, No. 22, Acts of Parliament, 2023 (India).
The DPDP Act, 2023, aims to strike a compromise between the need for data-driven innovation and the privacy. It is a step toward bringing India's data protection practices into line with international standards and boosting trust in digital businesses. The Vision Behind the Digital Personal Data Protection Act, 2023 The Digital Personal Data Protection Act, 2023, was passed in order to establish a comprehensive legal framework for the protection of personal data in India. Protecting people's privacy has become essential in the digital age, since almost every aspect of our lives is documented in data, including social media interactions, financial transactions, and medical records. By granting people more control over their personal information in an increasingly linked society, the Act aims to restore authority to the data subject.
It is commonly compared to the European Union's General Data Protection Regulation, 2016 (GDPR). In order to manage the complexities of personal data in a future where digital interactions are universal the DPDP Act of 2023 was essentially created. It seeks to modernize and streamline regulations in order to keep up with the rapid advancements in technology, particularly in areas like artificial intelligence (AI), big data, and the Internet of Things (IoT). It also builds on the principles of previous data privacy regulations, such the GDPR of 2016. The Act was created to control how both public and private organizations gather, utilize, and store personal information. The regulation states that consumers will have greater knowledge about the data they provide and how it will be utilized in a more open and safer online environment.
In order to ensure that data security protocols are followed, the Act aims to clearly define rules for the collection, processing, and storage of personal data by both public and commercial organizations. It also strengthens user consent procedures in light of the DPDP Act of 2023, which adds new safeguards to ensure that users give their informed consent prior to data collection and are aware of the intended use of their data. Finally, it facilitates more robust enforcement methods, including sanctions for noncompliance and tougher sanctions for noncompliance, which, by increasing the penalty for organizations that disregard the set rules, deters potential offenders. One of the most crucial aspects of the Act is its emphasis on user permission, which mandates that businesses obtain user’s express consent before collecting and using their data.
By exercising their rights to data access, data correction, and the right to be forgotten, people can also recover control over their personal information. Although these regulations are intended to safeguard people’s privacy, the Act contains a number of exceptions that permit government agencies to access and manage personal data under particular conditions. These exclusions are a topic of much debate and concern. Empowering Privacy: Provisions of the Digital Personal Data Protection Act, 2023 At its core, the DPDP Act of 2023 aims to provide people more control over their personal data so they may protect their privacy in an increasingly data-driven environment. The Act contains a number of important clauses aimed at making sure that data subjects are not taken advantage of and that their personal information is handled fairly and openly.
It recognizes that there are situations in which the government needs access to personal information. These exclusions are comparable to clauses found in data privacy legislation worldwide and are usually framed around public safety and national security. The scope of these exclusions, however, calls into question possible abuses of authority and the danger of a surveillance state. The Act’s most important and probably most user-empowering elements centre on giving people more control over their personal data. These clauses are intended to allay rising worries about the lack of user agency and openness in data collecting. The legislation aims to empower users in an otherwise complicated and opaque data-driven environment by imposing stronger consent procedures, demanding greater openness, and granting additional rights for data subjects.
Stronger Control Over Personal Data- The DPDP Act, 2023, enhances the concept of user consent by ensuring that individuals are informed and have control over the data they provide. Businesses must, for example, get express consent before gathering and using data, particularly when it comes to sensitive personal information (such as bank records or biometric information). In actuality, this lowers the possibility of unauthorized data exploitation by giving consumers the freedom to choose which services or features they wish to activate and under what circumstances. Additionally, users’ rights to access their own data are strengthened under the Act of 2023. People may now ask for comprehensive information on how their data has been used, how long it will be kept, and who has access to it.
Instead, then depending just on businesses self-regulation, this openness enables people to take charge of their own privacy and security. Supporting User Autonomy- The DPDP Act of 2023 promotes autonomy by expanding data rights. Users have the option to limit the processing of specific data categories or request that their data be deleted the so-called “right to be forgotten”6. By reducing the power disparity between users and data controllers and enhancing user agency, these rights allow people to take back control of their own data. Informed and Explicit Consent- The need for informed, express permission is one of the tenets of the DPDP Act of 2023. Users’ explicit, unambiguous consent must be obtained by organizations before they may collect, process, or share their personal information.
A personal information may only be processed for legitimate purposes with the individual’s permission. For a specified goal, the consent needs to be “free, specific, informed, unconditional and unambiguous with a clear affirmative action. ”7 Only the data necessary for the intended use may be collected. Notification (as mandated by section 5 of the act) must be submitted before requesting permission. “The notification should contain details about the personal information to be collected and the purpose of processing. The consent may be withdrawn at any time.
But according to section 7 of the Act, the following are instances of legitimate uses: a) Voluntary acceptance; b) Provision of any subsidy, benefit, service, license, certificate, or permit by any Indian state agency or department, provided that the individual has previously consented to receive any other such service from the state; c) Security or sovereignty; d) Fulfilling a legal obligation to provide information to the state; e) Adherence to judgments, decrees, or orders; f) A medical emergency or threat to life, public health, or epidemics; and g) Calamity or a violation of the law. ”8 The parent or legal guardian will provide their approval for anyone under the age of eighteen. This implies that consumers have the power to determine who may access their data, why, and
6 The Digital Personal Data Protection Act, 2023, § 12(1), No. 22, Acts of Parliament, 2023 (India).
7 The Digital Personal Data Protection Act, 2023, § 6(1), No. 22, Acts of Parliament, 2023 (India).
8 Team GeekforGeek “Digital Personal Data Protection Act 2023”, GEEKSFORGEEKS.ORG (Dec. 26, 2024,
6:16AM), https://www. geeksforgeeks. org/digital-personal-data-protection-bill-2023/ for how long. Additionally, the Act mandates that permission be rescindable at any moment, giving consumers the freedom to regain control over their personal information if they so want. This clause aims to improve openness and lessen the possibility that people would unintentionally agree to intrusive data practices. Strengthening User Rights- In order to guarantee that people have the authority to manage and safeguard their personal data, the DPDP Act, 2023, places a high priority on user rights. Some of the key rights enshrined in the Act include: • Right to Access: Customers may see more clearly how their information is being used by exercising their right to view all personal data that an organization holds about them.
This includes the ability to ask for thorough reports on the information gathered, its intended use, and any outside parties it may have been shared with9. • Right to Correction and Deletion: Users have the option to request the deletion or correction of obsolete or erroneous data. This gives people the authority to guarantee that the information kept on them is correct and up to date10. • Right to Data Portability: Customers can request that their personal data be transferred across service providers, ensuring that they can do so without being subjected to unnecessary limitations or lock-in processes. • Right to Object and Withdraw Consent: Users can object to data processing operations and revoke consent at any moment under the DPDP Act, 2023. This guarantees that people have more precise control over the usage of their data and when it is used11.
In contrast to the existing environment, where data collecting activities frequently take place with little user awareness or control, these rights provide people a far better degree of sovereignty over their personal information. Mandatory Data Protection Measures- Organizations must take practical steps to safeguard the data they gather against abuse, breaches, and unauthorized access under the DPDP Act of
2023. This entails implementing pseudonymization, encryption, and frequent audits of their
9 The Digital Personal Data Protection Act, 2023, § 11(1), No. 22, Acts of Parliament, 2023 (India).
10 The Digital Personal Data Protection Act, 2023, § 12(1), No. 22, Acts of Parliament, 2023 (India).
11 The Digital Personal Data Protection Act, 2023, § 12, No. 22, Acts of Parliament, 2023 (India).
data security procedures. The Act attempts to stop identity fraud, data theft, and other types of data abuse that might endanger people by making corporations answerable for protecting personal data. Data Breach Notification- In case of data breach, the Act also mandates that enterprises notify board and users as soon as possible12. Affected parties must be notified as soon as possible if personal data is compromised. This alert lessens the effect of any security issue by providing consumers with the chance to take precautionary measures, such changing passwords or freezing accounts. Data Security and Organizational Accountability- Chapter II of the DPDP Act, 2023 contains the obligations of “Data Fiduciary”13, anyone who decides the reason and method of processing personal data, either by themselves or in collaboration with others, i. e.
, Companies that deal with personal information must take strict precautions to protect it from breaches, abuse, and illegal access. Companies are required under the DPDP Act of 2023 to use best practices for data protection, including anonymization, encryption, and routine audits of data security procedures. Additionally, the legislation holds companies responsible for any data breaches and mandates that they promptly inform the Data Protection Board and any impacted parties. This guarantees that consumers are notified when their data is compromised, giving them the chance to take precautions. The Risks of a Surveillance State: Concerns Over Data Collection and Government Access The most controversial aspects of the DPDP Act of 2023 are the government exemptions, even though the act offers significant privacy protections for individuals.
In some situations, such as for maintaining public order, preventing crime, or ensuring national security, these exemptions give authorities access to personal information. The Act’s Section 17(1)(c) exempts data processing for the “prevention, detection, investigation, or prosecution of any offence or contravention of any law” from the notice and consent requirements. Although these exemptions make sense in some situations, Section 17(2)(a) creates a more comprehensive and wide-ranging exemption that permits any government agency, as designated by the
12 The Digital Personal Data Protection Act, 2023, § 8(6), No. 22, Acts of Parliament, 2023 (India).
13 The Digital Personal Data Protection Act, 2023, § 2(i), No. 22, Acts of Parliament, 2023 (India).
government, to be completely exempt from the application of the law in areas pertaining to public order, sovereignty, security, integrity, and the avoidance of incitement. Given Section 17(1)(c), this clause seems unnecessary and emphasizes the legislative aim to provide particular state entities a broad exemption from the data protection legislation. Section 17(2)(a)’s wide language clearly demonstrates Parliament’s intention to provide a broad nonapplication of the data protection legislation to certain government institutions, which might reduce the law’s overall efficacy and reach. Critics contend that these clauses may unintentionally allow for widespread monitoring and jeopardize people’s privacy, resulting in a surveillance state.
The threat of a surveillance state is increased by the government exemptions listed in the Digital Personal Data Protection Act, 2023, especially those pertaining to public order, crime prevention, and national security. A surveillance state is one in which the government has broad authority over people’s digital activities and personal information, resulting in widespread monitoring and a breach of privacy. Certain provisions of the Act, according to critics, may unintentionally result in the bulk gathering of personal information, which might then be used for surveillance purposes under the pretence of national security or commercial reasons. Broadening Data Collection Mechanisms- The possibility for the DPDP Act, 2023 to facilitate more widespread data gathering methods is one of the main objections against the law.
Although the legislation mandates that businesses get user agreement, some opponents contend that consent isn’t always fully informed, particularly in intricate, highly technological circumstances like biometric surveillance or AI-powered applications. For instance, consumers could feel pressured to provide a lot of personal information in return for the ease of utilizing free services like cloud storage or social networking platforms. Additionally, some businesses may have confusing or imprecise provisions in their privacy policies that give them a lot of freedom to gather and utilize personal information in the name of “legitimate interests. ”14 Increased Government Access to Data- The act’s ability to be used by government organizations to defend greater access to personal information is another issue.
Although the legislation specifies guidelines for data processing and storage, there are several exceptions that could provide government officials access to users’ personal information in situations involving public safety or national security15. This raise worries that the government, either
14 The Digital Personal Data Protection Act, 2023, § 7, No. 22, Acts of Parliament, 2023 (India).
15 The Digital Personal Data Protection Act, 2023, § 17(2)(a), No. 22, Acts of Parliament, 2023 (India). directly or through tech corporations, may utilize these laws to carry out widespread citizen monitoring. There is a major power imbalance when data can be accessed for security purposes without user consent, particularly when there are insufficient or ambiguous safeguards against misuse. If the national security exclusions are applied indiscriminately, the government’s extensive authority to gather and access personal data may open the door to monitoring people’s travels, conversations, and internet activities. Such clauses may cause the government to overreach and violate people’s right to privacy in nations with weaker checks and balances. These exclusions, according to some detractors, open the door to widespread surveillance.
Through backdoor deals with digital companies or outright demands to businesses, governments might use data protection rules as a basis to request access to customer data. A situation where users’ personal information is shared with state institutions without sufficient controls to prevent misuse might result from this. Access Personal Data to Protect National Security and Sovereignty- The government is expressly permitted to access personal data under Section 17 (2) (a) of the DPDP Act of 2023 in order to protect the nation’s sovereignty and integrity and for national security concerns. Assuming that national security reasons exceed individual privacy rights, this clause gives authorities the power to get around many of the privacy protections available to people.
This exemption’s justification stems from the claim that obtaining intelligence that includes the acquisition of personal information may be necessary to defend the country against both internal and foreign threats. To identify or stop security concerns, this may entail monitoring internet activity, intercepting conversations, or gaining access to data from private businesses. Although the national security rationale seems sense, the Act of 2023 unclear protections provide a precipice that may result in overreach. The broad and ambiguous language around national security may permit extensive monitoring without obvious accountability, which might result in widespread invasions of privacy. Such exclusions could open the door for unrestricted monitoring methods that disregard people’s rights if they are not closely monitored.
Access Personal Data to Maintain Public Order and Preventing Public Harm- In order to preserve public order and guard against harm to the public, the government is also authorized to access personal data under the Section 17(1)(a) of DPDP Act of 2023. This clause might be used to support surveillance in a number of situations, such as keeping tabs on demonstrations, tracking activist organizations’ activities, or monitoring people for public safety. Although upholding public order is a valid objective for all governments, there is a significant risk of overreach in this situation. It can be difficult to distinguish between proper law enforcement and political control, and the authority to monitor people in the name of “public order”16 may be abused to quell political opposition, stifle dissent, or keep tabs on the activities of marginalized groups.
These worries raise serious questions about the potential chilling impact that such surveillance may have on political participation and free expression, two essential components of a democratic society. Access Personal Data to Preventing and Investigating Crimes- The DPDP Act, 2023 permits government officials to access personal data for the purposes of criminal investigation and prevention in addition to national security. This involves obtaining information for criminal investigations, law enforcement, and the prevention of crimes including cybercrime, human trafficking, and terrorism. This clause raises questions regarding the breadth of data gathering and the possibility of misuse, even yet law enforcement authorities require access to personal data in order to prevent and solve crimes.
For example, in some circumstances, such as when it is thought essential for an investigation, the Act permits authorities to obtain data without the user's knowledge or consent. This raises concerns about the volume of data being gathered, who may access it, and if its usage conflicts with people’s right to privacy. Furthermore, the possibility of mass data monitoring through the gathering of private data for the goal of preventing crime may result in the tracking and profiling of people according to their online activity. This may violate fundamental civil freedoms, unfairly target particular groups, and foster a culture of continuous monitoring, even of those who are not accused of committing any crimes.
Lack of Clear Boundaries for Data Retention- Although there are rules for the keeping of personal data under the DPDP statute, 2023, the statute permits variety of possible retention periods, particularly where data is required for “legitimate interests”17. Opponents argue that this wide latitude might be abused by governments or groups to hold onto vast amounts of personal information for long periods of time, raising the possibility of abuse and spying. Furthermore, this prolonged retention period may result in individuals being watched and monitored over time across several digital platforms, whether or not they are aware of it, in a world where data is becoming more and more valuable for political and economic reasons. The 16 The Digital Personal Data Protection Act, 2023, § 17(2)(a), No. 22, Acts of Parliament, 2023 (India).
17 The Digital Personal Data Protection Act, 2023, § 7, No. 22, Acts of Parliament, 2023 (India).
Act of 2023 permits the government to get personal information in needed to maintain public order or stop social damage. This clause may be used, for example, to keep tabs on protests, follow activist movements, or monitor people who are part of social or political movements. Public order may be a valid priority for the government, but there is a serious risk of overreach. Authorities might monitor dissent, harass political opponents, or stifle free expression using personal data under this law. A risky precedent for unrestricted monitoring is created by the arbitrary character of public order and the absence of clear standards for its implementation.
Data Localization Requirements- Provisions in the DPDP Act, 2023 also encourage or require data localization within national borders, which can improve data security by keeping sensitive information within a jurisdiction’s legal framework, but it may also make it easier for governments to access vast amounts of data without international oversight. Critics contend that this requirement could encourage states to gather vast amounts of personal data, which would further facilitate surveillance. Erosion of Privacy Rights- One of the primary objectives of the DPDP Act of 2023 is to protect people's privacy, yet the government exemptions blatantly conflict with this objective. By granting authorities access to personal data without rigorous assessment or clear limitations, the exemptions run the risk of undermining the same privacy protections that the legislation seeks to offer.
Data that should be kept private may be watched if there are insufficient protections to ensure that it is utilized solely for the purposes for which it was intended. The DPDP Act, 2023, amends the Right to Information Act, 2005 (RTI Act) by declaring that the government is not required to reveal information on personal data. Because requests made under the RTI Act, 2005 frequently contain personal information, the amendment to Section 8(1)(j) of the RTI Act, 2005, which is implemented by Section 44(3) of the DPDP Act, 2023, upsets the established balance between privacy and the right to information. Public material officers (PIOs) now appear to have more discretionary power to deny RTI requests on the grounds that the requested material relates to personal data.
“The effectiveness of the RTI Act may be compromised by this change, as Member of Parliament Adhir Ranjan Chowdhury noted in Parliament. He warned that such changes could usher in a “new era of corruption,” where important personal data, including the assets, liabilities, and educational backgrounds of officials, may be protected from public scrutiny under the RTI Act”18. Lack of Oversight and Accountability- The absence of control and openness about government exemptions is a major worry. There isn’t any discussion of precise procedures to guarantee accountability, even if the Act could offer some explanations for government access to personal information. Potential abuses of power may go unnoticed if independent monitoring organizations or judicial review procedures lack the authority to keep an eye on government acts.
These exclusions could result in the development of a surveillance system that is hard to regulate and prone to abuse in the absence of explicit and binding protections. According to the DPDP Act of 2023, government organizations may access personal information without an individual’s consent if it is thought to be essential for maintaining national security or preserving the integrity and sovereignty of the nation. Since it may be claimed that access to personal data is required to stop cyberattacks, terrorism, and other dangers to the state, national security is frequently used as a defence for expansive government powers. The issue, though, is the absence of precise rules for what qualifies as a real national security danger. There are worries about the possibility of unjustified surveillance because of how broad this exemption is.
National security might be used as justification for keeping an eye on activists, political opponents, or even regular people who might not be engaged in any illegal action in nations with authoritarian governments or inadequate democratic protections. The extent of government monitoring might be dangerously increased in the absence of a strong supervision system, infringing on people’ right to privacy and restricting their freedom of speech. Potential for Political Abuse and Discrimination- The politicization of data access is one of the surveillance state’s most serious threats. These capabilities may be used by governments, particularly those with authoritarian inclinations, to keep tabs on activists, political rivals, or certain demographic groups.
Unrestricted access to personal data may enable targeted monitoring of people based on their social and economic standing, affiliations, or even their views in a society that is becoming more and more divided. Because people are afraid to express themselves freely because they may be watched, this can result in prejudice against specific populations and the repression of dissent. In order to investigate and prevent crimes, government officials are also granted access to personal data under the DPDP Act, 2023. Accessing communications and other private information that could be pertinent to a criminal 18 The Wire Staff, “Opposition Demands Data Protection Bill Be Sent to Parliamentary Committee”, THE WIRE, August 03, 2023, https://thewire. in/politics/data-protection-bill-opposition-parliamentary-committee inquiry is part of this.
Although law enforcement needs access to data for criminal investigations, the Act does not outline any restrictions or protections to guarantee that this data is not utilized for reasons other than the investigation. Law enforcement organizations run the danger of collecting large amounts of data or profiling people, which might violate their right to privacy even in the absence of any evidence of crime. Concerns over possible abuses of power are also raised by the absence of judicial oversight and third-party checks on law enforcement agencies’ access to personal data. This can lead to political targeting or the tracking and repression of marginalized groups using personal data in nations with weak legal frameworks.
The Potential for a Surveillance State It is clear from the aforementioned allusions to the Act that it grants the Union government broad discretionary authority, which might jeopardize its primary goals of data protection. Under the guise of defending national interests including sovereignty, national security, public order, and international relations, the Act grants government agencies extensive exemptions. This broad discretion prompts worries about the possibility of abuse and unchecked executive power, which may lead to excessive violations of people’s right to privacy. The broad exclusions granted to governmental organizations may make it easier to get around data protection laws, undermining the purpose of the law.
The provisions allowing the Union government to exclude data fiduciaries or categories of data fiduciaries from their duties may lead to selective duty avoidance, which might compromise the effectiveness of the Act. Additionally, there are no restrictions on the period of time the government may retain data or on how it may be used, either digitally or nondigitally (once it has been converted to digital format). Because there are no restrictions, data principals do not have the “right to be forgotten”19 with regard to information that is retained by the government. The Central Government’s power to ask the Board, any Data Fiduciary, or an intermediary for “such information”20, “for purposes of this Act”21 adds ambiguous and broad language. From a legislative perspective, this broad wording implies a hidden desire for governmental monitoring.
The government's extensive authority to exempt itself, demand information from businesses, and keep data forever may enable widespread monitoring techniques. Historic court
19 The Digital Personal Data Protection Act, 2023, § 12, No. 22, Acts of Parliament, 2023 (India).
20 The Digital Personal Data Protection Act, 2023, § 36, No. 22, Acts of Parliament, 2023 (India).
21 The Digital Personal Data Protection Act, 2023, § 40, No. 22, Acts of Parliament, 2023 (India).
decisions confirming that the right to privacy is a fundamental but not unqualified constitutional right raise these issues. The unbridled authority granted by the Act may infringe upon the right to privacy, which the courts have always recognized as an essential component of individual freedoms. The DPDP Act, 2023 main worry is that, in spite of its privacy-focused features, the government exemptions run the risk of fostering a surveillance state. In this case, there would be no control or restrictions on the use of personal data, and government agencies would have broad access to it. Some of the dangers include: • Mass surveillance: The extensive reach of the exemptions may lead to population-wide surveillance, impacting everyone, whether or not they are accused of any crime.
• Chilling effect on dissent: If citizens believe that the government is watching or recording their activities, they may choose not to express themselves freely. • Abuse of power: Personal information may be used by governments, particularly those with authoritarian inclinations, to target political rivals, put down demonstrations, or exert control over underprivileged groups. • Lack of transparency and accountability: The DPDP Act ,2023 which grants the government access to personal data without clear judicial oversight or transparency, opens the door to potential abuse. In Justice K. S. Puttaswamy v. Union of India22 Supreme Court ruled that the right to privacy is a fundamental part of the right to life and personal liberty of the Indian Constitution, as stated in Article 21.
The ruling specifically said that in this modern technology era, an individual’s personal information, particularly his biometric information, might constitute valuable information and be utilized by someone with illegal access; thus, informational privacy protection must be ensured. No one, not even the government, may access a person’s personal information without authorization. A citizen's right to privacy, particularly informational privacy, was maintained by the Supreme Court. Since the Court held in the same opinion that any infringement of this right may only take place within the bounds of necessity, legality, and proportionality, even state-led monitoring must essentially abide by these constraints. A committee of experts was established more recently in the Manohar Lal Sharma v. Union of
22 Justice K. S. Puttaswamy v. Union of India, AIR 2017 SC 4161.
India23 case, sometimes referred to as the “Pegasus case”, to make recommendations for modifications to the existing surveillance laws in order to safeguard the right to privacy. Source: Hindustan Times As a result, Indian courts even endorse the need to limit monitoring activities, especially given privacy concerns. Recent incidents like the Pegasus eavesdropping scandal and the pervasive usage of surveillance methods like contact tracing and facial recognition technology without the necessary safeguards or legislation have particularly alarmed the public. Future approaches to surveillance legislation may potentially affect digital trade, as states examine the privacy safeguards provided to data in other jurisdictions when determining data flow agreements.
Historic rulings by the Honourable Court that support the right to privacy as a fundamental, if constrained, constitutional right serve to emphasize these monitoring concerns. The Act's unbridled powers may infringe upon the right to privacy, which courts have affirmed over and again as a basic component of individual liberty. The Honourable Courts have held in a number of important decisions that monitoring people without a justifiable, reasonable, and required purpose is also a violation of their right to privacy. The Supreme Court affirmed that the CBI’s authority to intercept phone conversations without fair and reasonable procedural safeguards violated the right to privacy in the case of PUCL v. Union of India24, also referred to as the “Telephone Tapping Case. ” The court ruled that everyone has the freedom to speak on the phone without worrying about being overheard.
In Ram Jethmalani & Others v. Union of
23 Manohar Lal Sharma v. Union of India, AIR 2021 SC 5396.
24 PUCL v. Union of India, AIR 1997 SC 568.
India25, also referred to as the “Black Money Case,” the Supreme Court ruled that disclosing a person's bank account information without providing sufficient evidence to indict them of wrongdoing is a violation of their right to privacy. Government investigators are not allowed to divulge bank account information without good reason. Even if he is not physically confined, the Supreme Court ruled in Kharak Singh v. State of Uttar Pradesh26 that a person cannot be considered to live his life while someone is always watching him. Conclusion: A Fine Line Between Empowerment and Control Being home to one of the biggest democracies, it is our responsibility to uphold national security and empower our citizens to exercise their rights.
Over the years, national security and privacy have generally been seen as conflicting concerns; yet, with the development of technology and methods of digital monitoring, safeguarding citizen data has also become crucial. In order to handle the intricate interplay between privacy, data ownership, and technological innovation, the DPDP Act of 2023 is a crucial step. Users are certainly empowered on the one hand by having greater control over their personal data, greater transparency, and additional abilities to manage and remove data. People can move more confidently in the digital world thanks to the improved privacy safeguards that help prevent unwanted data collection and exploitation.
There are legitimate worries, though, that the legislation would also make surveillance possible by allowing for more thorough data collecting and, in some cases, giving government officials wider access to user data. The legislation has elements that might be abused by governments and companies to compromise the same privacy it seeks to protect, even as it works to create a framework that restricts data exploitation. Our system is currently beset by problems. Fundamentally, our laws’ vague definitions of terms that determine their scope or provide their justifications have permitted surveillance operations to exceed their intended goals. Along with establishing suitable procedural protections, the system must fortify the accountability mechanisms through judicial or legislative monitoring.
These steps would drastically reduce the state's discretionary powers, which now have wide latitude in determining how much it may utilize its monitoring authorities.
25 Ram Jethmalani & Others v. Union of India, 2011(8) SCC 1.
26 Kharak Singh v. State of Uttar Pradesh, AIR 1963 SC 1295.
It's time to totally restructure India's monitoring system in order to address these problems, as opposed to implementing sweeping regulations or invasions of privacy. It is difficult for us to apply these ideas to more complicated security issues and surveillance methods, such digital espionage, because the fundamental framework now in use is outdated. Establishing a precise, purposeful, appropriate, and comprehensive system while establishing privacy-respecting activities as the standard is the goal of any new framework in this area. In the end, how the legislation is implemented and how businesses, governments, and individuals understand and implement its provisions will determine whether the DPDP Act of 2023 empowers users or permits monitoring.
To guarantee that privacy rights are maintained without sacrificing security or supervision, ongoing review and modification will be required, as is the case with any regulation in a constantly changing digital environment. The DPDP Act of 2023 must be supplemented by strict protections to prevent unrestrained surveillance in order to achieve a fair balance. This entails making certain that court supervision, explicit restrictions, and accountability procedures apply to any government access to personal data. Protecting people’s privacy while making sure that data protection regulations don’t allow the government to violate fundamental civil freedoms should be the aim.